Chamilo model.ajax.php - SQL Injection

main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. id: CVE-2021-34187 info: name: Chamilo model.ajax.php - SQL Injection author: DhiyaneshDK severity: critical description: | main/inc/ajax/model.ajax.php in Chamilo...

Blink Router - Command Injection

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bsSetSSIDHide function. id: CVE-2025-45985 info: name: Blin...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

Youzify < 1.2.0 - Unauthenticated SQLi

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection id: CVE-2022-1950 info: name: Youzify 1.2.0 - Unauthenticated SQLi author:...

Kyocera Net View Address Book Exposure

Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function. id: CVE-2022-1026 info: name: Kyocera Net View Address Book Exposure autho...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Discourse - Unauthenticated Mailpace Webhook Bounce-Score Forgery

Discourse's WebhooksController contains a missing-authentication flaw caused by accepting requests to provider webhook endpoints including /webhooks/mailpace, SendGrid, Mailjet, Mandrill, Postmark, and SparkPost without validating a token when none is configured, which is the default state, letti...

Oracle Business Intelligence - Path Traversal

Oracle Business Intelligence versions 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0 are vulnerable to path traversal in the BI Publisher formerly XML Publisher component of Oracle Fusion Middleware subcomponent: BI Publisher Security. id: CVE-2019-2588 info: name: Oracle Business Intelligence - Path...

criticality_score

Open Source Project Criticality Score Beta This project is maintained by members of the Securing Critical Projects WG. Goals 1. Generate a criticality score for every open source project. 2. Create a list of critical projects that the open source community depends on. 3. Use this data to...

MailAccess

Let's connect mailaccess.pro · Docs · PyPI · Changelog Open-source email OSINT and email scraper. One email in, every account behind it: 82 modules check 5,300+ platforms, and every finding says how it was found and how sure we are. One domain in, every public email at the company. Run it on your...

cve-scores

CVE Scores EPSS & VEDAS Score Aggregator for CVEs Data Providers SCORE| MAINTAINER| PURPOSE| COVERAGE| ATTRIBUTION| FREQUENCY ---|---|---|---|---|--- Exploit Prediction Scoring System EPSS| Empirical Security| Prediction of Future Exploitation| 1 Identifier CVE| Proprietary Data sourced from Data...

malscore

🦠 malscore malscore takes a Linux command line, or a session of commands such as a shell history, and returns a 0–100 maliciousness score with a verdict band and MITRE ATT&CK mapping: commands → features → signals → score + MITRE mapping It never executes, expands or resolves anything — it only...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

pocindex

PoC Index : Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context. Find exploits by CVE, vendor, product or keyword. Compare CVSS severity, EPSS exploitation scores and CISA known-exploited status. Just landed Repo...

SEVulDet

SEVulDet SEVulDet is a semantics-enhanced deep learning-based framework that can accurately pinpoint vulnerability patterns by extracting, preserving, and learning more semantics. E-mail for communication: [email protected] Details of SEVulDet Recent years have seen increased attention to de...

cve-collector

CVE-Collector Simple Latest CVE Collector Written in Python There are various methods for collecting the latest CVE Common Vulnerabilities and Exposures information. This code was created to provide guidance on how to collect, what information to include, and how to code when creating a CVE...

CVE-2024-38063

CVE-2024-38063 - Remotely Exploiting The Kernel Via IPv6 Since the latest Windows patch dropped on the 13th of August I’ve been deep in the weeds of tcpip.sys the kernel driver responsible for handling TCP/IP packets. A vulnerability with a 9.8 CVSS score in the most easily reachable part of the...

ExtendIntel

ExtendIntel This package extends the Intel package to log more fields If the intel file contains the following fields, the data will automatically be added to the intel.log. threatscore verdict verdictsource confidence desc lastseen firstseen url reports campaigns associated category...

Jordy Meow AI Engine - Unrestricted File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine- ChatGPT Chatbot.This issue affects AI Engine- ChatGPT Chatbot- from n/a through 1.9.98. id: CVE-2023-51409 info: name: Jordy Meow AI Engine - Unrestricted File Upload author: pussycat0x severity: critical...

HDI-GraphRAG-Attack

Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM Jisung Park, John Le, Heath Cooper Institute of Cybersecurity and Cryptology iC², University of Wollongong IFIP SEC 2026 jspacific0307/HDI-graphragpipeline...